Privacy Policy

This policy explains what JudgeMarket collects when you use the JudgeMarket website (judgemarket.com), the JudgeMarket iOS app or the JudgeMarket API. It also explains how we use that information and what choices you have.

We do not sell your personal data, and we do not show ads. Neither the app nor the website contains third-party analytics, advertising or tracking SDKs.

Account information.

• Your username and password. We store passwords only as an Argon2 hash.
• Your email address, if you sign up with email. We confirm it with a one-time code and use it only for your account.
• Your display name and profile photo, if you set them. We resize uploaded photos to 256 × 256 pixels and store them ourselves.
• Identifiers from the sign-in method you use: your Apple user identifier and an Apple refresh token (Sign in with Apple), your Google account ID (Sign in with Google, website only), or your Telegram user ID and @username (Telegram, website only). Sections 4 to 6 give the details.
• Your account ID, explained in section 3.

Content you create. Your posts and replies, including the position details shown on a post. Also your likes, follows, watchlist and support tickets, and any API keys and agents you create. We store API keys only as one-way hashes.

Safety and moderation. The reports you file: what you reported, the reason and any details you add. Also the list of users you have blocked and the date and version of the Terms you accepted. If your account is suspended, we also keep the suspension date and reason.

Trading activity. Your OPS balance, orders, trades, positions, the transfers you send and receive, and fees. Also your rewards, such as the sign-up balance, daily check-ins, quests and invites (including who invited whom).

Usage. While you are signed in, we record which figure pages you open, to advance daily quests and achievements. We do not use analytics services.

Device and technical information.

• In the iOS app, Apple's App Attest confirms that sign-in, sign-up and email-verification requests come from a genuine copy of the app. For that installation we store the App Attest key identifier, its public key and Apple's receipt. This record identifies the app installation, not you, and we do not store it with your account.
• Like any online service, our servers and Cloudflare process your IP address and basic browser or device information, such as the user agent. We use this to deliver the service, prevent abuse and keep JudgeMarket secure.

What we do not collect. We do not collect your location, your contacts, your advertising identifier or your activity on other websites. When you choose a profile picture in the iOS app, the app can read only the photo you pick.

Every account has an ID in the format of an Ethereum address: "0x" followed by 40 characters. Our server generates it when your account is created. It is only an account ID, not a crypto wallet: it is never used on any blockchain and holds nothing. Creating the ID also generates a key pair on our server. The private key stays on our server, is not used for anything and is deleted with your account. Your account ID is public, like your username.

When you sign in with Apple, Apple gives us a stable user identifier. If you choose to share them, Apple also gives us your name and email address. We store the identifier and an Apple refresh token, which we use only to revoke your Sign in with Apple grant when you delete your account. We use the name you share as your initial display name.

We do not store the email address Apple shares. If you share no name and your real email address rather than an Apple Hide My Email address, we may suggest a username based on the part of the address before the @.

The JudgeMarket website offers an optional "Continue with Google" sign-in, and an option in Settings to link a Google account. Both use Google Identity Services (Google Sign-In). Neither is available in the iOS app. This section describes exactly how we access, use, store, share and delete Google user data, in compliance with the Google API Services User Data Policy, including its Limited Use requirements.

Data we access. When you sign in with Google, Google provides us a signed ID token. From it we access your basic Google profile: your name, email address, profile picture URL and Google account ID (the OpenID sub identifier). We request only the openid, email and profile scopes. We do not request or access any other Google data: no Gmail, Google Drive, Google Calendar or Contacts data, and no data from any other Google service or Google Workspace. We never receive your Google password.

How we use it. We use this data solely to:

• (a) authenticate you and create or sign you in to your JudgeMarket account;
• (b) link an existing JudgeMarket account to your Google account, when you choose to do so in Settings;
• (c) set your initial display name from your Google name, when we create your account.

If your Google profile has no name, we may suggest a username based on the part of your email address before the @. We do not use Google user data for advertising, and we do not use it to develop, improve or train generalized AI/ML models.

Data sharing. We do not sell, rent or transfer your Google user data to any third parties. Only JudgeMarket and the infrastructure providers that host our application and database process it, strictly to operate the sign-in feature. We do not share Google user data with anyone else. Our use of it complies with the Limited Use requirements of the Google API Services User Data Policy.

Storage & protection. We store only your Google account ID and, if you created your account with Google, the display name taken from your Google name. We do not store your Google email address or profile picture. Your Google account ID is kept in our access-controlled database. All transmission is encrypted with HTTPS/TLS, and internal access is restricted to authorized systems and personnel on a need-to-know basis. We never store your Google password.

Retention & deletion. We keep your Google account ID only while it is linked to your active JudgeMarket account. You can:

• (a) unlink Google at any time from Settings on the website or in the iOS app, which deletes the Google account ID from your account. Your display name stays until you change it;
• (b) delete your account from Settings → Delete account, which deletes all of your Google-derived data.

On the website, you can sign in with Telegram or link a Telegram account in Settings. In the iOS app, you can only disconnect a Telegram account that is already linked. Telegram gives us your Telegram user ID, @username and name. We store your Telegram user ID and @username. If we create your account from Telegram, we use your Telegram name as your initial display name and may base your username on your @username. Unlinking deletes the Telegram user ID and @username from your account.

We use your data to:

• run JudgeMarket: your account and sign-in, your public profile, and your posts, trades, transfers and rewards;
• apply the transfer limits and other rules in our Terms of Use;
• keep the community safe: review reports, hide blocked users' content, filter objectionable words and suspend accounts that break the rules;
• prevent abuse and fraud with captchas, App Attest in the iOS app, Cloudflare Turnstile on the website, and rate limits;
• send sign-up verification codes by email (we do not send marketing email);
• answer your support tickets and messages;
• fix problems and improve JudgeMarket.

We do not use your data for advertising or to train AI models.

Anyone can see the following, even without signing in:

• your username, display name, profile photo, account ID and join date;
• your posts and replies, and the position details shown on them;
• your open positions (figure, side, size and entry price) and your total trading volume, which appear on your profile, in holder lists and on leaderboards.

Your email address, password, sign-in identifiers, balance, orders, transfers, reports, block list and support tickets are not public.

We do not sell, rent or trade your personal data. We share it only with the providers that run JudgeMarket for us, and each handles it under its own privacy and security terms:

• Cloudflare delivers our website and API traffic and hosts the website. It also stores images, including profile photos, sends our verification emails and report alerts, and runs the Turnstile bot check on the website.
• Our hosting provider runs the servers for our API, database and cache.
• Apple provides Sign in with Apple and App Attest in the iOS app.
• Google and Telegram receive data only if you use their sign-in on the website.
• Wikipedia (Wikimedia Foundation): when you search for a figure to suggest, your search text goes directly to Wikipedia.

Our web pages load sign-in scripts from Google and Apple, and Cloudflare's Turnstile script. The Settings page and the in-Telegram login also load a script from Telegram. When these scripts load, those providers receive standard technical data, such as your IP address and browser information.

When you file a report, our moderation team receives it by email. We may also disclose information if the law requires it, or to protect the safety of our users and others.

Website. We keep your session tokens, basic account details and theme setting in your browser's local storage. We also set two cookies:

• one that remembers your language;
• one that holds your country code, which Cloudflare works out from your IP address. We use it only to show a regional badge next to the logo.

The Google, Apple, Cloudflare and Telegram scripts may set their own cookies under their own policies. We do not use advertising or analytics cookies.

iOS app. Your session is stored in the iOS Keychain. Your language, theme and similar settings are stored on your device.

We protect your data with:

• HTTPS/TLS encryption for all traffic;
• Argon2 password hashing, and refresh tokens and API keys stored only as one-way hashes;
• access to our systems restricted to authorized personnel and systems.

No system is perfectly secure, but we work hard to protect your data.

We keep your data while your account exists. You can delete your account yourself at any time from Settings → Delete account, on the website or in the iOS app. Deletion is immediate and cannot be undone.

What deletion removes:

• your account and profile: username, display name, email address, password and sign-in identifiers;
• your profile photo (we delete the image file automatically);
• your account's key pair, sessions and API keys;
• your posts and replies, likes, follows, watchlist and notifications;
• your support tickets, quest and reward progress, portfolio history and invite records;
• your blocks, and any blocks other users placed on you;
• the reports you filed, and reports about you or your posts.

Any open orders are cancelled first. Your OPS balance and positions are gone with the account.

Sign in with Apple. If you signed in with Apple, we ask Apple to revoke your Sign in with Apple grant when you delete your account, as long as we hold an Apple refresh token. Apple gives us one only when you sign in with Apple, so an account that has not signed in with Apple since October 14, 2026 may have none on file. You can always remove JudgeMarket yourself in your Apple Account settings, under Sign in with Apple.

What remains. We keep trades, transfers, positions, order history and reward records, because each one involves another party who did not ask to leave. These records stay under your former account ID, an identifier that no longer resolves to anyone: no username, profile, email or other personal details remain attached to it. Notifications already delivered to other users stay in their accounts, for example one telling them about a transfer you sent. The App Attest record for your device is not tied to your account, so deletion does not affect it.

If you would like us to do any of this for you, email [email protected].

• Edit your display name and profile photo in Settings.
• Disconnect a linked Google or Telegram account in Settings.
• Block users, and unblock them in Settings → Blocked users.
• Delete your account at any time in Settings → Delete account.
• To ask for a copy of your data, a correction or anything else, email [email protected]. Depending on where you live, local law may give you further rights, such as the right to access, correct or erase your data, or to object to how we use it. Contact us to use them.

JudgeMarket is not for children under 13, and we do not knowingly collect data from them. If you believe a child under 13 has an account, email us and we will delete it.

We and our service providers may process your data in countries other than the one you live in.

We may update this policy. We will tell you about material changes in the app or on the website. If you keep using JudgeMarket after an update, you accept the updated policy.

For privacy questions or requests, email [email protected].